AhnLab describes Kimsuky intrusions that use presumed spear phishing to install BabyShark and then add RDP-focused tooling for hands-on control of infected Windows systems. The activity includes hwp.bat, PowerShell keylogging through k.ps1 and OneNote.vbs, loaders such as pow.ps1 and desktop.r7u, and injector behavior tied to xRAT or related malware in earlier cases. Follow-on payloads include multiple.exe, which modifies termsrv.dll, enables multiple RDP sessions, creates a hidden IIS_USER administrator account, and supports stealthier remote access. A newer RevClient component receives C2 commands, can add or hide accounts, and forwards attacker traffic to local RDP through 5.61.59.53:2086.